The preferred embodiments relate to network element communications and, more particularly, to improved security of such communications and to protect against third party security threats.
Network elements (or nodes) are typically logical entities that communicate onto a telecommunication or computing system network, so as to communicate with at least one other network element, according to a common network management scheme that involves various layers of protocol. These various layers provide a conceptual model, where one well known example is the Open Systems Interconnection (OSI) model. In this and comparable models, each network layer has an associated protocol and, other than the lowermost physical layer, is served by a layer beneath it. In the OSI model, the highest layer, which interacts with an end user, is the application layer, and beneath it are several layers. The second lowest layer is the data link, which is sometimes called the Media Access Control or MAC layer, although a logical link control layer may also be a part of this layer. The MAC layer defines the frame as its protocol data unit and defines the communication over a link between two network elements and the flow control between them. The lowest layer is the physical layer, which is so named as it represents the electrical and physical connectivity of the data communication to/from the physical transmission medium (e.g., cable or wireless frequency) of the network, so as to transmit and receive bits over the medium that represent the frames received from the MAC layer.
While network element communications according to the above principles are widely implemented, various forms of security also have been added so as to protect communications from potential nefarious actions by third parties. Such security may take various forms, such as authentication and encryption. Authentication typically confirms a network element's authority to connect to a network, usually at the commencement of communication (or a communication session). Encryption, however, continues to protect successive communications, for example by encrypting each data frame communicated between two network elements. In this regard, encryption may be implemented at any layer above PHY. In any event, under the encryption methodology, a transmitting network element uses a cryptographic key to encrypt a data frame, after which the encrypted frame is then transmitted and the intended destination receiving network element then decrypts the encrypted frame, with that receiving network element having knowledge of the original encryption key.
Various types of encryption keys and processes exist, and what they have in common is the security is predicated on only the transmitting and receiving network elements having knowledge of the key for a session. In this regard, it is known in the art that nefarious third parties may seek to uncover or otherwise discover an encryption key and, if successful, the party may then intercept frames communicated between the intended proper network elements and, with the key, nefariously decrypt the frames between those elements. Toward this end, also known in the art is that such a wrongdoer may collect and store a number of frames into what is referred to as a “dictionary,” and from analyses on such a dictionary determine the encryption key used to encrypt the frames in the dictionary. Having this key, and as stated above, thereby permits unauthorized decryption by the third party of the captured frames.
Recognizing the above, the prior art has developed additional methodologies to reduce the chance of illicit discovery of encryption keys. As a first example, during a communication session, the key may be periodically changed, where such an approach is sometimes referred to as re-keying. Thus, the wrongdoer is prevented from collecting a sufficient amount of frames that are encrypted per a single key, thereby reducing or eliminating the chance of the key being discovered. This approach, however, has various disadvantages, including higher network overhead, potentially having to rekey an entire network, and added complexity in the presence of “sleepy” devices needing to be re-keyed, while not readily accessible if in a sleep state. As a second example, unique session tokens can be generated for every session, whereby the token is further used as part of the encryption/decryption process. This approach also has various disadvantages, including session key maintenance overhead, and it also is susceptible to dictionary attack if a session and its token are maintained over a period of time sufficient to allow the wrongdoer enough information to get past both the encryption key and the accompanying token.
Given the preceding, there arises a need to address certain security issues in network element communications and to improve on the prior art approaches, and the preferred embodiments are directed to such a need as further explored below.